Open menu

HTML Entity Encoder & Decoder

Convert characters that have a special meaning in HTML into safe character references, or turn references such as é or 😀 back into readable text. Choose whether to escape only the five HTML-special characters, every non-ASCII character, or all symbols, and whether to use named entities, decimal or hexadecimal codes. Unknown named entities are reported instead of being silently dropped.

Mode
Encode
Style

Input

60 characters

Output

Escaped
<p class="note">Tom & Jerry’s “café” costs €5 — 50% off!</p>

Checks

  • Info Only the five HTML-special characters are escaped. That's all a UTF-8 page needs; accents and symbols can stay as they are.

Runs entirely in your browser. Nothing you paste or open here is uploaded or stored.

How to use the HTML entity tool

  1. Choose Encode or Decode.
  2. For encoding, choose what to escape: Only & < > “ ’, Also non-ASCII, or All symbols.
  3. Choose the style: named (&amp;), decimal (&#38;) or hex (&#x26;).
  4. Paste your text and copy the result.

When decoding, named, decimal and hex references are all recognised. Unknown names stay as they are and are listed under the result.

How character references work

HTML reserves a few characters: < starts a tag, & starts a character reference, and quotes end attribute values. To show them as text, you write a reference instead:

  • &lt; for <, &gt; for >, &amp; for &, &quot; for " and &#39; for '.
  • Numeric references name any Unicode code point: &#8364; or &#x20AC; is €.

The HTML standard defines over 2,000 names. This tool includes the common ones (typography, currency, arrows, maths and accented letters used in English, German and Spanish) and uses numeric references for everything else, so the output is always valid. Decoding replaces invalid code points (such as lone surrogates) with the replacement character, as browsers do.

Worked examples

Example 1: showing code in a blog post

You want readers to see <p class="note"> instead of the browser treating it as a tag. Encode with the default option and paste the result inside <pre><code>. The tags appear exactly as typed.

Example 2: an ASCII-only email template

Some email systems mangle non-ASCII text. Encode with Also non-ASCII and the named style: café becomes caf&eacute; and €5 becomes &euro;5, which every email client displays correctly.

Example 3: cleaning scraped text

Text copied from a CMS export contains &rsquo;, &ldquo; and &#128512;. Decode it to get curly quotes and the emoji back. The sample also contains &bogus;, which is listed as unknown so you can fix it by hand.

Escaping vs encoding

Entity escaping is for HTML. For other places, use the right tool:

  • URLs: percent-encoding (%20), with the URL encoder.
  • JavaScript strings: é escapes or JSON encoding.
  • CSS content: \E9 escapes.

Mixing them up is a common source of bugs and security holes.

Common mistakes

  • Double escaping. &amp;amp; shows up as &amp; on the page. Escape once, at output time.
  • Escaping accents unnecessarily on UTF-8 pages, which makes source code hard to edit.
  • Forgetting the semicolon. &copy works in some places by legacy rules, but &copy; always works.
  • Escaping for the wrong context. HTML escaping doesn’t make a value safe inside a <script> block or a javascript: URL.

Frequently asked questions

Which characters must be escaped in HTML?

In text content, & and < must be escaped. Inside attribute values, also the quote character that delimits the value. Escaping all five (& < > " ') is the safe default and is what this tool's first option does.

Do I need entities for accents and symbols?

Not on a page saved and served as UTF-8, which almost every site is. Characters like é, €, ñ and emoji can be written directly. Entities are only needed when a file must stay pure ASCII, such as some email templates or legacy systems.

What's the difference between named, decimal and hex references?

They all produce the same character. &eacute; is easy to read, &#233; and &#xE9; use the Unicode code point in decimal or hexadecimal. Not every character has a name, so numeric references work for everything.

Does escaping protect against XSS?

Escaping text before inserting it into HTML is one essential part of preventing cross-site scripting. But it must match the context: URLs, JavaScript and CSS need different escaping. Use your framework's automatic escaping where possible.

Do I need to escape quotes?

Only inside attribute values: escape " as &quot; in double-quoted attributes and ' as &#39; in single-quoted ones. In normal text, quotes are fine as they are.

Sources